Read the docs
TI-2021-02509 Aliases CVE-2021-3557GHSA-8fgv-frq2-3468

Incorrect permission assignment in argocd

Priority LOW 30CWE-732Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

A flaw was found in argocd. Any unprivileged user is able to deploy argocd in their namespace and with the created ServiceAccount argocd-argocd-server, the unprivileged user is able to read all resources of the cluster including all secrets which might enable privilege escalations. The highest threat from this vulnerability is to data confidentiality.

Why it matters now

EPSS 0.00764 55th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—argocdargocd 1.1.1—No fix listedCNA
  • argocd Vendor— Affected argocd 1.1.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:*before 1.1.1Vulnerableargoproj
cpe:2.3:a:redhat:openshift_gitops:1.1:*:*:*:*:*:*:*1.1VulnerableRed Hat
  • cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* Versions before 1.1.1 Vulnerable ·argoproj
  • cpe:2.3:a:redhat:openshift_gitops:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2021:2053 Released 2021-05-19 · Red Hat rating Important
    Red Hat OpenShift GitOps security update
    • Red Hat OpenShift GitOps 1.1 openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-operator-bundle +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift GitOps 1.1Fixed RHSA-2021:2053

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3557
  2. 2026-10-03 Alias added: GHSA-8fgv-frq2-3468

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences